#!/bin/bash
# ============================================================
# AETHER CHAT — Kurulum Scripti
# Apache 2.4 + PHP 7.4 + MariaDB
#
# BU SCRIPT APACHE'YE DOKUNMAZ.
# Sadece: DB + Composer + WebSocket servis + Cron
#
# Kullanim: sudo bash install.sh
# ============================================================

set -e
RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; BLUE='\033[0;34m'; NC='\033[0m'
log()  { echo -e "${GREEN}[✓]${NC} $1"; }
warn() { echo -e "${YELLOW}[!]${NC} $1"; }
err()  { echo -e "${RED}[✗]${NC} $1"; exit 1; }
info() { echo -e "${BLUE}[i]${NC} $1"; }

[ "$EUID" -ne 0 ] && err "Root olarak calistir: sudo bash install.sh"

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
INSTALL_DIR="/var/www/aether/server"

echo ""
echo -e "${BLUE}╔══════════════════════════════════════════════════╗${NC}"
echo -e "${BLUE}║        AETHER CHAT — Kurulum Basliyor            ║${NC}"
echo -e "${BLUE}║   Apache'ye dokunulmayacak, mevcut siteler safe  ║${NC}"
echo -e "${BLUE}╚══════════════════════════════════════════════════╝${NC}"
echo ""

# ── 1. PHP 7.4 kontrol ───────────────────────────────────────────────────────
info "PHP 7.4 kontrol ediliyor..."
PHP_BIN=""
for bin in php7.4 php; do
    if command -v $bin &>/dev/null; then
        ver=$($bin -r 'echo PHP_MAJOR_VERSION.".".PHP_MINOR_VERSION;' 2>/dev/null)
        if [[ "$ver" == "7.4" ]]; then
            PHP_BIN=$(command -v $bin)
            log "PHP 7.4 bulundu: $PHP_BIN ($($bin -r 'echo PHP_VERSION;'))"
            break
        fi
    fi
done
[ -z "$PHP_BIN" ] && err "PHP 7.4 bulunamadi! 'php -v' kontrol et."

# ── 2. Gerekli PHP uzantıları ────────────────────────────────────────────────
info "PHP uzantilari kontrol ediliyor..."
MISSING=""
for ext in pdo_mysql mbstring curl xml json sockets; do
    if ! $PHP_BIN -m 2>/dev/null | grep -qi "^${ext}$"; then
        MISSING="$MISSING php7.4-${ext//_/-}"
    fi
done

if [ -n "$MISSING" ]; then
    warn "Eksik uzantilar kuruluyor:$MISSING"
    apt-get update -qq
    apt-get install -y -qq $MISSING
    log "PHP uzantilari kuruldu"
else
    log "Tum PHP uzantilari mevcut"
fi

# sockets uzantısı Ratchet için şart
if ! $PHP_BIN -m 2>/dev/null | grep -qi "^sockets$"; then
    apt-get install -y -qq php7.4-common 2>/dev/null || true
fi

# ── 3. PHP-FPM socket bul ────────────────────────────────────────────────────
info "PHP-FPM kontrol ediliyor..."
PHP_FPM_SOCK=""
for sock in /var/run/php/php7.4-fpm.sock /run/php/php7.4-fpm.sock; do
    if [ -S "$sock" ]; then
        PHP_FPM_SOCK="$sock"
        log "PHP-FPM socket: $PHP_FPM_SOCK"
        break
    fi
done

if [ -z "$PHP_FPM_SOCK" ]; then
    warn "PHP-FPM baslatiliyor..."
    apt-get install -y -qq php7.4-fpm 2>/dev/null || true
    systemctl start php7.4-fpm
    systemctl enable php7.4-fpm
    PHP_FPM_SOCK="/var/run/php/php7.4-fpm.sock"
    log "PHP-FPM baslatildi"
fi

# ── 4. MariaDB / MySQL ───────────────────────────────────────────────────────
info "Veritabani kontrol ediliyor..."
if command -v mysql &>/dev/null; then
    log "MySQL/MariaDB mevcut"
    systemctl start mariadb 2>/dev/null || systemctl start mysql 2>/dev/null || true
else
    warn "MariaDB bulunamadi, kuruluyor..."
    apt-get update -qq
    apt-get install -y -qq mariadb-server mariadb-client
    systemctl start mariadb
    systemctl enable mariadb
    log "MariaDB kuruldu"
fi

# ── 5. Composer ──────────────────────────────────────────────────────────────
info "Composer kontrol ediliyor..."
if ! command -v composer &>/dev/null; then
    warn "Composer bulunamadi, kuruluyor..."
    curl -sS https://getcomposer.org/installer | $PHP_BIN
    mv composer.phar /usr/local/bin/composer
    chmod +x /usr/local/bin/composer
    log "Composer kuruldu"
else
    log "Composer mevcut"
fi

# ── 6. Proje dizini ───────────────────────────────────────────────────────────
info "Proje dizini hazirlaniyor: $INSTALL_DIR"
mkdir -p "$INSTALL_DIR"/{api,ws,cron}

if [ "$SCRIPT_DIR" != "$INSTALL_DIR" ]; then
    if command -v rsync &>/dev/null; then
        rsync -a --exclude='vendor/' --exclude='.env' "$SCRIPT_DIR/" "$INSTALL_DIR/"
    else
        cp -rn "$SCRIPT_DIR"/. "$INSTALL_DIR"/ 2>/dev/null || true
    fi
    log "Dosyalar kopyalandi: $SCRIPT_DIR -> $INSTALL_DIR"
fi

# ── 7. Güvenlik anahtarları ───────────────────────────────────────────────────
# Eğer .env zaten varsa üzerine yazma
if [ -f "$INSTALL_DIR/.env" ]; then
    warn ".env zaten mevcut, yeni anahtar uretilmiyor"
    source "$INSTALL_DIR/.env" 2>/dev/null || true
    DB_PASS="${DB_PASS:-$(openssl rand -base64 20 | tr -d '+/=\n' | head -c20)}"
    PHONE_SALT="${PHONE_SALT:-$(openssl rand -hex 32)}"
    INTERNAL_KEY="${INTERNAL_KEY:-$(openssl rand -hex 32)}"
else
    info "Guvenlik anahtarlari uretiliyor..."
    DB_PASS=$(openssl rand -base64 20 | tr -d '+/=\n' | head -c20)
    PHONE_SALT=$(openssl rand -hex 32)
    INTERNAL_KEY=$(openssl rand -hex 32)
fi

# ── 8. Veritabanı ─────────────────────────────────────────────────────────────
info "Veritabani hazirlaniyor..."

# MySQL bağlantısını dene
MYSQL_CMD=""
if mysql -u root -e "SELECT 1;" &>/dev/null 2>&1; then
    MYSQL_CMD="mysql -u root"
elif mysql -e "SELECT 1;" &>/dev/null 2>&1; then
    MYSQL_CMD="mysql"
else
    echo -n "MySQL root sifresi girin (bos birakabilirsiniz): "
    read -s MYSQL_ROOT_PASS
    echo ""
    if mysql -u root -p"$MYSQL_ROOT_PASS" -e "SELECT 1;" &>/dev/null 2>&1; then
        MYSQL_CMD="mysql -u root -p$MYSQL_ROOT_PASS"
    else
        err "MySQL'e baglanamadi! Root sifreni kontrol et."
    fi
fi

$MYSQL_CMD <<SQL
CREATE DATABASE IF NOT EXISTS aether CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER IF NOT EXISTS 'aether_user'@'localhost' IDENTIFIED BY '$DB_PASS';
GRANT SELECT,INSERT,UPDATE,DELETE,CREATE,DROP,INDEX,ALTER,CREATE TEMPORARY TABLES,LOCK TABLES,EVENT
    ON aether.* TO 'aether_user'@'localhost';
FLUSH PRIVILEGES;
SQL
log "Veritabani olusturuldu: aether"

# Şemayı yükle
$MYSQL_CMD aether < "$INSTALL_DIR/schema.sql"
log "Schema yuklendi (5 tablo)"

# ── 9. .env yaz ──────────────────────────────────────────────────────────────
info ".env yaziliyor..."
cat > "$INSTALL_DIR/.env" <<ENV
APP_ENV=production
DB_HOST=127.0.0.1
DB_PORT=3306
DB_NAME=aether
DB_USER=aether_user
DB_PASS=$DB_PASS
PHONE_SALT=$PHONE_SALT
INTERNAL_KEY=$INTERNAL_KEY
WS_PORT=8090
WS_HOST=0.0.0.0
RATE_LIMIT_LOGIN=10
RATE_LIMIT_LOOKUP=30
ENV
chmod 600 "$INSTALL_DIR/.env"
chown www-data:www-data "$INSTALL_DIR/.env"
log ".env olusturuldu (izin: 600)"

# ── 10. Dosya izinleri ────────────────────────────────────────────────────────
info "Dosya izinleri ayarlaniyor..."
chown -R www-data:www-data /var/www/aether
find "$INSTALL_DIR" -type f -name "*.php" -exec chmod 644 {} \;
find "$INSTALL_DIR" -type d -exec chmod 755 {} \;
chmod 600 "$INSTALL_DIR/.env"
log "Izinler ayarlandi"

# ── 11. Composer bağımlılıkları ───────────────────────────────────────────────
info "Ratchet WebSocket kuruluyor..."
cd "$INSTALL_DIR"
sudo -u www-data composer install --no-dev --optimize-autoloader --no-interaction 2>/dev/null || \
    composer install --no-dev --optimize-autoloader --no-interaction
log "Composer bagimliliklar yuklendi"

# ── 12. WebSocket relay servisi ───────────────────────────────────────────────
info "WebSocket relay servisi kuruluyor..."
cat > /etc/systemd/system/aether-relay.service <<SVCEOF
[Unit]
Description=Aether Chat WebSocket Relay Server
After=network.target
Wants=network.target

[Service]
Type=simple
User=www-data
Group=www-data
WorkingDirectory=$INSTALL_DIR
ExecStart=$PHP_BIN $INSTALL_DIR/ws/relay_server.php
Restart=always
RestartSec=5
StartLimitBurst=5
StartLimitIntervalSec=60
EnvironmentFile=$INSTALL_DIR/.env
StandardOutput=journal
StandardError=journal
SyslogIdentifier=aether-relay
NoNewPrivileges=true
PrivateTmp=true

[Install]
WantedBy=multi-user.target
SVCEOF

systemctl daemon-reload
systemctl enable aether-relay

# relay_server.php henüz yoksa servisi başlatma
if [ -f "$INSTALL_DIR/ws/relay_server.php" ]; then
    systemctl start aether-relay
    sleep 2
    if systemctl is-active --quiet aether-relay; then
        log "WebSocket relay servisi baslatildi (port 8090)"
    else
        warn "Servis baslatılamadi. BLOK 3 sonrasi tekrar dene:"
        warn "sudo systemctl start aether-relay"
    fi
else
    warn "relay_server.php henuz yok (BLOK 3'te yazilacak)"
    warn "Blok 3 tamamlandiktan sonra: sudo systemctl start aether-relay"
fi

# ── 13. Cron job ──────────────────────────────────────────────────────────────
info "Cron job ekleniyor..."
CRON_LINE="0 * * * * $PHP_BIN $INSTALL_DIR/cron/cleanup.php >> /var/log/aether_cleanup.log 2>&1"
( crontab -u www-data -l 2>/dev/null | grep -v "aether_cleanup"; echo "$CRON_LINE" ) \
    | crontab -u www-data -
log "Cron eklendi (saatte bir temizlik)"

# ── 14. Apache config talimatları (elle yapılacak) ────────────────────────────
echo ""
echo -e "${YELLOW}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
echo -e "${YELLOW}  APACHE AYARI — Bunu sen yapacaksin (2 adim)        ${NC}"
echo -e "${YELLOW}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
echo ""
echo "  Adim 1 — VirtualHost dosyasini kopyala ve duzenle:"
echo ""
echo "    sudo cp $INSTALL_DIR/aether.apache.conf \\"
echo "            /etc/apache2/sites-available/aether.conf"
echo ""
echo "    sudo nano /etc/apache2/sites-available/aether.conf"
echo "    (yourdomain.com → kendi domain'in, 3 yerde)"
echo ""
echo "  Adim 2 — Test et ve etkinlestir:"
echo ""
echo "    sudo apache2ctl configtest      # once test et"
echo "    sudo a2enmod proxy proxy_http proxy_wstunnel rewrite headers ssl"
echo "    sudo a2ensite aether"
echo "    sudo systemctl reload apache2"
echo ""
echo "  Adim 3 — SSL al:"
echo ""
echo "    sudo certbot --apache -d senindomain.com"
echo ""

# ── Özet ─────────────────────────────────────────────────────────────────────
echo -e "${GREEN}╔══════════════════════════════════════════════════════╗${NC}"
echo -e "${GREEN}║         Script tamamlandi!                           ║${NC}"
echo -e "${GREEN}╚══════════════════════════════════════════════════════╝${NC}"
echo ""
echo -e "${RED}  !!! BU BILGILERI KAYDET !!!${NC}"
echo ""
printf "  %-15s %s\n" "DB Kullanici:"  "aether_user"
printf "  %-15s %s\n" "DB Sifresi:"    "$DB_PASS"
printf "  %-15s %s\n" "DB Adi:"        "aether"
printf "  %-15s %s\n" "Phone Salt:"    "$PHONE_SALT"
printf "  %-15s %s\n" "Internal Key:"  "$INTERNAL_KEY"
printf "  %-15s %s\n" "PHP Binary:"    "$PHP_BIN"
printf "  %-15s %s\n" "FPM Socket:"    "$PHP_FPM_SOCK"
printf "  %-15s %s\n" "Proje Dizini:"  "$INSTALL_DIR"
echo ""
echo "  Log izle: sudo journalctl -u aether-relay -f"
echo ""